General

  • Target

    PONYDOODOO.png

  • Size

    186KB

  • Sample

    241102-yb75pstekn

  • MD5

    868076ce3956526083cf3f29bf156c2c

  • SHA1

    432d9335d2cb2dee2dde6f6301ae3349e3d239b7

  • SHA256

    7682efae2c4916c1750fe643fd85f2fdc2b8209e2fedb8691b4612a811e61ce5

  • SHA512

    49481e1bae76ba838f7e006f960c6f5bff5978317c5f3b4905effefde8c65394aacf91c9ad465816a08b279aa4cc81c28e4fbd01859bc59935a7fb0e08bd13d8

  • SSDEEP

    3072:snx5651LC8bLMxnBozjxGPwgbKwLZfoNTtd3SP4AuD2Nrn0ZqeYm/zvyQbpCkef:x+8bLMxnBozQPwyKwltVxnkYm/zvFbpu

Malware Config

Targets

    • Target

      PONYDOODOO.png

    • Size

      186KB

    • MD5

      868076ce3956526083cf3f29bf156c2c

    • SHA1

      432d9335d2cb2dee2dde6f6301ae3349e3d239b7

    • SHA256

      7682efae2c4916c1750fe643fd85f2fdc2b8209e2fedb8691b4612a811e61ce5

    • SHA512

      49481e1bae76ba838f7e006f960c6f5bff5978317c5f3b4905effefde8c65394aacf91c9ad465816a08b279aa4cc81c28e4fbd01859bc59935a7fb0e08bd13d8

    • SSDEEP

      3072:snx5651LC8bLMxnBozjxGPwgbKwLZfoNTtd3SP4AuD2Nrn0ZqeYm/zvyQbpCkef:x+8bLMxnBozQPwyKwltVxnkYm/zvFbpu

    • Disables Task Manager via registry modification

    • Possible privilege escalation attempt

    • Executes dropped EXE

    • Modifies file permissions

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Sets desktop wallpaper using registry

MITRE ATT&CK Enterprise v15

Tasks